- Wrap the Worker with @cloudflare/workers-oauth-provider: /oauth/token,
/oauth/register (dynamic client registration), and /.well-known/* are
implemented by the library; tokens/grants/clients live in OAUTH_KV.
- New consent page at /oauth/authorize reuses the session cookie;
unauthenticated visitors bounce through the SPA login via returnTo.
- Grant props store only userId; oauthPropsAuth re-fetches the user from
D1 on every MCP request, so deleting a user revokes access instantly.
Permissions still flow exclusively through visibleMails().
- OAuth is optional: without the OAUTH_KV binding the provider is skipped
entirely and /mcp keeps working with aik_ API keys only. With it, both
credentials coexist (Bearer aik_ requests pre-route around the provider).
- Docs and wrangler examples updated; KV block commented out by default.
TooonyChen
d6731f8180